Skip to content

Commit a903b56

Browse files
jiridanekcursoragent
jiridanek
and
cursoragent
committed
NO-JIRA: ci(runners): enhanced podman DNS diagnostics for IBM runners
- Install python3 in all diagnostic steps (fix "command not found") - Add resolv.conf before/after podman install comparison (test if systemd-resolved package breaks DNS config) - Add GODEBUG=netdns=cgo test (force Go to use glibc getaddrinfo) - Add public DNS override test (write 8.8.8.8 to resolv.conf) - Add nslookup, getent, python3 getaddrinfo for cross-resolver comparison - Add DNS resolution test inside unshare --user namespace - Externalize test Containerfile to ci/cached-builds/Containerfile.test Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 6b541fb commit a903b56

2 files changed

Lines changed: 76 additions & 27 deletions

File tree

‎.github/workflows/test-ibm-podman-dns.yaml‎

Lines changed: 74 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ name: Test podman DNS in privileged container
66
branches: [jd_ibm_runners]
77
paths:
88
- '.github/workflows/test-ibm-podman-dns.yaml'
9+
- 'ci/cached-builds/Containerfile.test'
910
workflow_dispatch:
1011

1112
jobs:
@@ -22,61 +23,91 @@ jobs:
2223
platform: linux/s390x
2324

2425
steps:
25-
- name: Create test Containerfile
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
with:
28+
persist-credentials: false
29+
sparse-checkout: ci/cached-builds/Containerfile.test
30+
31+
- name: "Diagnose: resolv.conf BEFORE and AFTER podman install"
32+
if: ${{ !cancelled() }}
2633
run: |
27-
printf 'FROM quay.io/centos/centos:stream9-minimal\nRUN echo "hello from $(uname -m)"\n' > /tmp/Containerfile.test
34+
set -x
35+
sudo docker run --rm --privileged --network=host \
36+
registry.fedoraproject.org/fedora:44 \
37+
bash -c '
38+
echo "=== resolv.conf BEFORE podman install ==="
39+
ls -la /etc/resolv.conf
40+
cat /etc/resolv.conf
41+
echo "=== /etc/nsswitch.conf ==="
42+
cat /etc/nsswitch.conf 2>/dev/null || echo "no nsswitch.conf"
2843
29-
- name: "Test: rootful podman (default)"
44+
dnf install -y --quiet podman python3
45+
46+
echo "=== resolv.conf AFTER podman install ==="
47+
ls -la /etc/resolv.conf
48+
cat /etc/resolv.conf
49+
echo "=== check if systemd-resolved broke resolv.conf ==="
50+
ls -la /run/systemd/resolve/ 2>/dev/null || echo "/run/systemd/resolve/ does not exist"
51+
echo "=== test DNS with python3 (glibc getaddrinfo) ==="
52+
python3 -c "import socket; print(socket.getaddrinfo(\"quay.io\", 443)[:1])" || echo "PYTHON DNS: FAILED"
53+
echo "=== test DNS with getent ==="
54+
getent hosts quay.io || echo "GETENT DNS: FAILED"
55+
echo "=== test podman pull ==="
56+
podman pull quay.io/centos/centos:stream9-minimal && echo "DEFAULT PULL: OK" || echo "DEFAULT PULL: FAILED"
57+
'
58+
59+
- name: "Test: GODEBUG=netdns=cgo (force Go cgo resolver)"
3060
if: ${{ !cancelled() }}
3161
run: |
3262
set -x
3363
sudo docker run --rm --privileged --network=host \
34-
-v /tmp/Containerfile.test:/tmp/Containerfile.test:ro \
64+
-e GODEBUG=netdns=cgo \
3565
registry.fedoraproject.org/fedora:44 \
3666
bash -c '
3767
dnf install -y --quiet podman
38-
echo "=== podman info ==="
39-
podman info --format "{{.Host.Security.Rootless}}"
40-
echo "=== default podman pull ==="
41-
podman pull quay.io/centos/centos:stream9-minimal && echo "DEFAULT PULL: OK" || echo "DEFAULT PULL: FAILED"
68+
echo "=== GODEBUG=$GODEBUG ==="
69+
podman pull quay.io/centos/centos:stream9-minimal && echo "CGO PULL: OK" || echo "CGO PULL: FAILED"
4270
'
4371
44-
- name: "Test: podman --userns=host"
72+
- name: "Test: fix resolv.conf before podman pull"
4573
if: ${{ !cancelled() }}
4674
run: |
4775
set -x
4876
sudo docker run --rm --privileged --network=host \
49-
-v /tmp/Containerfile.test:/tmp/Containerfile.test:ro \
5077
registry.fedoraproject.org/fedora:44 \
5178
bash -c '
5279
dnf install -y --quiet podman
53-
podman pull quay.io/centos/centos:stream9-minimal && echo "USERNS=HOST PULL: OK" || echo "USERNS=HOST PULL: FAILED"
54-
podman build --userns=host --network=host -t test-userns -f /tmp/Containerfile.test /tmp/ && echo "USERNS BUILD: OK" || echo "USERNS BUILD: FAILED"
80+
echo "=== resolv.conf after install ==="
81+
cat /etc/resolv.conf
82+
echo "=== overwrite with public DNS ==="
83+
printf "nameserver 8.8.8.8\nnameserver 1.1.1.1\n" > /etc/resolv.conf
84+
cat /etc/resolv.conf
85+
podman pull quay.io/centos/centos:stream9-minimal && echo "PUBLIC DNS PULL: OK" || echo "PUBLIC DNS PULL: FAILED"
5586
'
5687
57-
- name: "Test: podman --isolation=chroot"
88+
- name: "Test: podman --userns=host"
5889
if: ${{ !cancelled() }}
5990
run: |
6091
set -x
6192
sudo docker run --rm --privileged --network=host \
62-
-v /tmp/Containerfile.test:/tmp/Containerfile.test:ro \
93+
-v ${{ github.workspace }}/ci/cached-builds/Containerfile.test:/tmp/Containerfile.test:ro \
6394
registry.fedoraproject.org/fedora:44 \
6495
bash -c '
6596
dnf install -y --quiet podman
66-
podman build --isolation=chroot --network=host -t test-chroot -f /tmp/Containerfile.test /tmp/ && echo "CHROOT BUILD: OK" || echo "CHROOT BUILD: FAILED"
97+
podman pull quay.io/centos/centos:stream9-minimal && echo "USERNS=HOST PULL: OK" || echo "USERNS=HOST PULL: FAILED"
98+
podman build --userns=host --network=host -t test-userns -f /tmp/Containerfile.test /tmp/ && echo "USERNS BUILD: OK" || echo "USERNS BUILD: FAILED"
6799
'
68100
69-
- name: "Test: podman with storage driver vfs"
101+
- name: "Test: podman --isolation=chroot"
70102
if: ${{ !cancelled() }}
71103
run: |
72104
set -x
73105
sudo docker run --rm --privileged --network=host \
106+
-v ${{ github.workspace }}/ci/cached-builds/Containerfile.test:/tmp/Containerfile.test:ro \
74107
registry.fedoraproject.org/fedora:44 \
75108
bash -c '
76109
dnf install -y --quiet podman
77-
mkdir -p /etc/containers
78-
printf "[storage]\ndriver = \"vfs\"\n" > /etc/containers/storage.conf
79-
podman pull quay.io/centos/centos:stream9-minimal && echo "VFS PULL: OK" || echo "VFS PULL: FAILED"
110+
podman build --isolation=chroot --network=host -t test-chroot -f /tmp/Containerfile.test /tmp/ && echo "CHROOT BUILD: OK" || echo "CHROOT BUILD: FAILED"
80111
'
81112
82113
- name: "Test: docker pull + podman load (skip podman networking)"
@@ -86,7 +117,7 @@ jobs:
86117
sudo docker pull quay.io/centos/centos:stream9-minimal
87118
sudo docker save quay.io/centos/centos:stream9-minimal -o /tmp/base-image.tar
88119
sudo docker run --rm --privileged --network=host \
89-
-v /tmp/Containerfile.test:/tmp/Containerfile.test:ro \
120+
-v ${{ github.workspace }}/ci/cached-builds/Containerfile.test:/tmp/Containerfile.test:ro \
90121
-v /tmp/base-image.tar:/tmp/base-image.tar:ro \
91122
registry.fedoraproject.org/fedora:44 \
92123
bash -c '
@@ -95,23 +126,39 @@ jobs:
95126
podman build --pull=never --network=host -t test-loaded -f /tmp/Containerfile.test /tmp/ && echo "BUILD FROM LOADED: OK" || echo "BUILD FROM LOADED: FAILED"
96127
'
97128
98-
- name: "Test: check namespace and socket diagnostics"
129+
- name: "Diagnose: namespace and socket deep dive"
99130
if: ${{ !cancelled() }}
100131
run: |
101132
set -x
102133
sudo docker run --rm --privileged --network=host \
103134
registry.fedoraproject.org/fedora:44 \
104135
bash -c '
105-
dnf install -y --quiet podman iproute procps-ng
106-
echo "=== /proc/self/status namespace info ==="
136+
dnf install -y --quiet podman iproute procps-ng python3 bind-utils
137+
138+
echo "=== /proc/self/status ==="
107139
grep -E "NSpid|NStgid|Uid|Gid|Cap" /proc/self/status
108-
echo "=== can we create sockets? ==="
140+
141+
echo "=== sockets from root namespace ==="
109142
python3 -c "import socket; s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); print(\"UDP socket: OK\")" || echo "UDP: BLOCKED"
110143
python3 -c "import socket; s = socket.socket(socket.AF_INET, socket.SOCK_STREAM); print(\"TCP socket: OK\")" || echo "TCP: BLOCKED"
111-
echo "=== DNS resolution ==="
112-
python3 -c "import socket; print(socket.getaddrinfo(\"quay.io\", 443))" || echo "DNS: FAILED"
113-
echo "=== unshare --user and socket ==="
144+
145+
echo "=== DNS with python3 (getaddrinfo / cgo path) ==="
146+
python3 -c "import socket; print(socket.getaddrinfo(\"quay.io\", 443)[:1])" || echo "PYTHON DNS: FAILED"
147+
148+
echo "=== DNS with nslookup ==="
149+
nslookup quay.io || echo "NSLOOKUP: FAILED"
150+
151+
echo "=== DNS with getent ==="
152+
getent hosts quay.io || echo "GETENT: FAILED"
153+
154+
echo "=== sockets inside unshare --user ==="
114155
unshare --user python3 -c "import socket; s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); print(\"UDP in user ns: OK\")" || echo "UDP in user ns: BLOCKED"
156+
unshare --user python3 -c "import socket; print(socket.getaddrinfo(\"quay.io\", 443)[:1])" || echo "DNS in user ns: BLOCKED"
157+
115158
echo "=== podman unshare + socket ==="
116159
podman unshare python3 -c "import socket; s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); print(\"UDP in podman ns: OK\")" 2>&1 || echo "UDP in podman ns: BLOCKED"
160+
161+
echo "=== resolv.conf final state ==="
162+
ls -la /etc/resolv.conf
163+
cat /etc/resolv.conf
117164
'

‎ci/cached-builds/Containerfile.test‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
FROM quay.io/centos/centos:stream9-minimal
2+
RUN echo "hello from $(uname -m)"

0 commit comments

Comments
 (0)